timechart sorting multiple fields

[balash1979]

I have the following query

index="search_index  | timechart avg(time1) as time1_in_mins ,avg(time2) as time2_in_mins |  sort time1 | tail 5 | sort time2 | tail 5

Basically, i want to show timechart values for 2 times and I want to sort both the times and show the top 5 values. By doing the above search, time2 is the one that gets sorted correctly. How can I fix the above query to sort both times.

[HiroshiSatoh]

Is this possible?

If there are 5 each

index="search_index  | timechart avg(time1) as time1_in_mins  |  sort time1_in_mins  | tail 5
|append [search index="search_index  | timechart avg(time2) as time2_in_mins | sort time2_in_mins | tail 5]

If there are 5 cases in total

index="search_index  |bin span=1h |stats (time1) as time1_in_mins ,avg(time2) as time2_in_mins by _time
|eval time=if(time1_in_mins <time2_in_mins,avtime1_in_mins,time2_in_mins)
|sort time|tail 5

[balash1979]

I have tried this way of appending 2 searches but the issue is if the first search completes first and the 2nd search takes time, the results dont come out correctly. Is there a way for the overall query to wait until both searches complete ?

[HiroshiSatoh]

Subsearch has the following restrictions.

[subsearch]: Search auto-finalized after time limit (60 seconds) reached.

It is necessary to change “limits.conf”.
https://answers.splunk.com/answers/267303/why-does-my-subsearch-maxtime-setting-in-limitscon.html